GoZone Ransomware Adopts Coercive Tactics to Extract Payment

This week, the SonicWall Capture Labs threat research team analyzed a ransomware that not only encrypts files but also accuses the victim of harboring explicit content on their computer and then threatens to turn it over to authorities if ransom is not paid. Extortion attacks often come as unsolicited emails, and GoZone has stooped to pretending to find explicit content on victims' machines to extract payment.

Infection Cycle

This ransomware is written in Go. It is apparent that it uses Chacha20 and RSA encryption packages as evidenced by its strings.

Figure 1: References to Chacha20 package in the binary's strings

Figure 2: References to RSA package in the binary's strings

Upon execution, it encrypts files in the victim's machine and appends "d3prU" to all encrypted files.

Figure 3: Encrypted files with d3prU file extension

A readme text file is created in every directory where files have been encrypted. This is one of the ransom notes that this malware creates.

Figure 4: Readme ransom note

It also creates another ransom note in the form of an html file which is then subsequently opened with the user's default browser.

Figure 5: Ransom note in html formal

To ensure that the victim does not miss the ransom payment instructions, the desktop wallpaper is also changed to show instructions on how to pay.

Figure 6: Desktop wallpaper showing payment instructions

The QR code at the bottom of the desktop wallpaper only copies the Bitcoin address "bc1qwemkeh2vu5ftzgat3sk87gr4mlskw898xd6tk5" to a browser. Checking this Bitcoin address on the blockchain reveals only a couple of transactions.

Figure 7: Recent transactions on this ransomware's Bitcoin address

The victim will be unable to change this wallpaper as the ability to update the background settings has now been disabled by the ransomware.

Figure 8: Background settings grayed out and unable to change

Upon further analysis, we found references to ransomware modules that show the different functionalities that this malware can employ:

• Add a scheduled task
• Disable UAC
• UAC Bypass
• Set wallpaper
• Self delete
• Overwrite MBR
• Remove system restore

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: GoZone.RSM(Trojan)

This threat is also detected by SonicWall Capture ATP w/RTDMI and the Capture Client endpoint solutions.